Complete Guide to ACE Permissions for FiveM

What is the ACE System?

ACE (Access Control Entry) is FiveM's native permissions system that allows you to:

• Control access to commands and features
• Create permission groups (admin, mod, VIP, etc.)
• Manage rights hierarchically
• Secure sensitive resources and commands

Basic Concepts

The Three Main Elements

1. Principal (Identity)

A principal is the identity of a player or group:

identifier.steam:110000xxxxxx  # Steam identifier
identifier.license:xxxxxx      # Rockstar License
identifier.discord:xxxxxx      # Discord ID
identifier.fivem:xxxxxx        # FiveM ID
group.admin                    # Group

2. ACE (Permission)

A specific permission:

command.kick                   # Kick permission
command.ban                    # Ban permission
resource.admin_menu            # Access to a resource

3. Allow/Deny

Allow or deny access:

allow    # Grants the permission
deny     # Denies the permission

Structure and Hierarchy

Execution Order

FiveM processes permissions in this order:

1. Player-specific permissions (identifier)
2. Group permissions (group)
3. Inherited permissions (inheritance)

Inheritance Principle

Groups can inherit permissions from other groups:

superadmin → admin → moderator → player

A superadmin has all admin permissions, which has all moderator permissions, etc.

Configuration in server.cfg

Basic Syntax

# Add a permission
add_ace <principal> <ace> <allow/deny>

# Add a principal to a group
add_principal <principal> <group>

# Inheritance between groups
add_ace <group1> <group2> allow

Configuration Examples

Simple Configuration: One Administrator

# Create the admin group
add_ace group.admin command allow

# Add a player to the admin group
add_principal identifier.steam:110000xxxxxx group.admin

This configuration gives all commands to the admin.

Advanced Configuration: Complete Structure

####################################
# ACE PERMISSIONS SYSTEM
####################################

# ===== SUPERADMIN GROUP =====
# All rights, including txAdmin
add_ace group.superadmin command allow
add_ace group.superadmin resource allow
add_ace group.superadmin builtin.everyone allow

# txAdmin access
add_principal identifier.steam:110000xxxxxx group.superadmin

# ===== ADMIN GROUP =====
# Inherits moderator rights + additional rights
add_ace group.admin group.moderator allow

# Admin-specific permissions
add_ace group.admin command.restart allow
add_ace group.admin command.stop allow
add_ace group.admin command.start allow
add_ace group.admin command.refresh allow
add_ace group.admin command.ensure allow
add_ace group.admin command.setjob allow
add_ace group.admin command.giveitem allow
add_ace group.admin command.givemoney allow
add_ace group.admin command.car allow
add_ace group.admin command.dv allow
add_ace group.admin command.tp allow
add_ace group.admin command.tpto allow
add_ace group.admin command.bring allow
add_ace group.admin command.freeze allow
add_ace group.admin command.unban allow
add_ace group.admin command.clearinventory allow
add_ace group.admin command.revive allow
add_ace group.admin command.setcoords allow
add_ace group.admin command.setmodel allow

# Add administrators
add_principal identifier.steam:110000yyyyyy group.admin
add_principal identifier.license:xxxxxx group.admin

# ===== MODERATOR GROUP =====
# Basic moderation permissions
add_ace group.moderator command.kick allow
add_ace group.moderator command.ban allow
add_ace group.moderator command.warn allow
add_ace group.moderator command.mute allow
add_ace group.moderator command.unmute allow
add_ace group.moderator command.screenshot allow
add_ace group.moderator command.spectate allow
add_ace group.moderator command.goto allow
add_ace group.moderator command.announce allow

# Add moderators
add_principal identifier.steam:110000zzzzzz group.moderator
add_principal identifier.discord:123456789 group.moderator

# ===== SUPPORT GROUP =====
# Limited technical support
add_ace group.support command.tp allow
add_ace group.support command.tpto allow
add_ace group.support command.bring allow
add_ace group.support command.revive allow
add_ace group.support command.announce allow

# Add support staff
add_principal identifier.steam:110000aaaaaa group.support

# ===== VIP GROUP =====
# VIP advantages without admin permissions
add_ace group.vip vip.priority allow
add_ace group.vip vip.customskin allow
add_ace group.vip vip.spawnvehicle allow

# Add VIPs
add_principal identifier.steam:110000bbbbbb group.vip
add_principal identifier.license:yyyyyy group.vip

# ===== SPECIAL PERMISSIONS =====
# Block certain commands for everyone except admin
add_ace builtin.everyone command.quit deny
add_ace builtin.everyone command.restart deny
add_ace group.admin command.quit allow
add_ace group.admin command.restart allow

Identifier Types

Steam ID

Most common and recommended:

add_principal identifier.steam:110000xxxxxx group.admin

How to find it:

1. Player connects to the server
2. In the server console, type status
3. Find the line with the player's username
4. Copy the identifier that starts with steam:

License (Rockstar)

add_principal identifier.license:xxxxxxxxxxxxxx group.admin

Discord ID

add_principal identifier.discord:123456789012345678 group.admin

How to find it:

1. Enable Discord developer mode
2. Right-click on the user → Copy ID

FiveM ID

add_principal identifier.fivem:xxxxxx group.admin

IP (Not Recommended)

add_principal identifier.ip:192.168.1.1 group.admin

Warning: IPs can change, use Steam/Discord instead.

Permissions for Specific Resources

Restrict Access to a Resource

# Block the admin_menu resource for everyone
add_ace builtin.everyone resource.admin_menu deny

# Allow only admins
add_ace group.admin resource.admin_menu allow

Custom Permissions in Scripts

Your scripts can check custom permissions:

# Define a custom permission
add_ace group.police police.armory allow
add_ace group.police police.vehicle allow

In your script:

if IsPlayerAceAllowed(source, 'police.armory') then
    -- Player can access the armory
end

Configuration with txAdmin

txAdmin Access

# Group for full txAdmin access
add_ace group.superadmin txadmin allow

# Add an administrator
add_principal identifier.steam:110000xxxxxx group.superadmin

Specific txAdmin Permissions

# Granular txAdmin permissions
add_ace group.admin txadmin.view allow
add_ace group.admin txadmin.control allow
add_ace group.superadmin txadmin.settings allow

Useful In-Game Commands

Check Player Permissions

As admin, in the F8 console:

test_ace <identifier> <ace>

Example:

test_ace steam:110000xxxxxx command.kick

Returns true or false.

List Active ACEs

list_aces

Displays all currently defined permissions.

Examples by Server Type

Roleplay Server

# Police
add_ace group.police police.menu allow
add_ace group.police police.armory allow
add_ace group.police police.handcuff allow
add_ace group.police police.vehicle allow
add_ace group.police command.revive deny

# EMS
add_ace group.ems ems.menu allow
add_ace group.ems ems.vehicle allow
add_ace group.ems command.revive allow
add_ace group.ems command.heal allow

# Mechanic
add_ace group.mechanic mechanic.menu allow
add_ace group.mechanic mechanic.repair allow
add_ace group.mechanic mechanic.vehicle allow

# Staff
add_ace group.staff command.tp allow
add_ace group.staff command.spectate allow
add_ace group.staff command.noclip allow

Freeroam Server

# VIP premium vehicle access
add_ace group.vip vehicle.premium allow
add_ace group.vip spawn.weapon allow

# Donators
add_ace group.donator spawn.custom allow
add_ace group.donator teleport.anywhere allow

# Freeroam admin
add_ace group.admin command.weapon allow
add_ace group.admin command.skin allow
add_ace group.admin command.god allow

Security and Best Practices

Principle of Least Privilege

Give only necessary permissions:

# ❌ BAD: Give everything
add_ace group.moderator command allow

# ✅ GOOD: Specific permissions
add_ace group.moderator command.kick allow
add_ace group.moderator command.ban allow
add_ace group.moderator command.warn allow

Protect Dangerous Commands

# Block system commands for everyone
add_ace builtin.everyone command.restart deny
add_ace builtin.everyone command.stop deny
add_ace builtin.everyone command.quit deny
add_ace builtin.everyone command.exec deny

# Allow only superadmins
add_ace group.superadmin command.restart allow
add_ace group.superadmin command.stop allow

Use Multiple Identifiers

For more security, combine Steam + Discord:

# Requires BOTH Steam AND Discord
add_principal identifier.steam:110000xxxxxx group.admin_steam
add_principal identifier.discord:123456789 group.admin_discord
add_ace group.admin_combined command allow

# Both must be present
add_principal group.admin_steam group.admin_combined
add_principal group.admin_discord group.admin_combined

Logs and Audit

Enable logs to track who uses which commands:

# In server.cfg
set sv_logLevel "info"
set sv_scriptHookAllowed 0

Troubleshooting

Permissions Not Working

Checks:

1. Restart the server completely (not just refresh)
2. Check exact spelling of identifiers
3. Use status in console to see connected identifiers
4. Identifiers are case-sensitive

Command Denied Despite Permissions

Possible causes:

• The script itself blocks the command
• Conflict with another permissions system (ESX, QBCore)
• Misspelled permission in server.cfg

Solution:

# Test with a global permission temporarily
add_ace identifier.steam:110000xxxxxx command allow

Groups Not Applying

Check the order:

# ❌ BAD: Group doesn't exist yet
add_principal identifier.steam:xxx group.admin
add_ace group.admin command allow

# ✅ GOOD: Create the group first
add_ace group.admin command allow
add_principal identifier.steam:xxx group.admin

Cannot Connect to txAdmin

Check:

# Make sure you have txadmin permission
add_ace group.superadmin txadmin allow
add_principal identifier.steam:110000xxxxxx group.superadmin

Integration with ESX/QBCore

ESX with ACE

ESX has its own group system, but can use ACE:

# Give ESX admin permissions
add_ace group.admin command.setjob allow
add_ace group.admin command.givemoney allow

# Link ACE with ESX group
add_principal identifier.steam:xxx group.admin

In the ESX database (users), also set the group to admin.

QBCore with ACE

QBCore uses ACE permissions natively:

# In server.cfg
add_ace group.god command allow
add_ace group.admin qbcore.admin allow

# In qb-core/server/main.lua
QBCore.Config.Server.Permissions = {
    ['god'] = {
        'steam:110000xxxxxx',
    },
}

Advanced Permissions

Temporary Permissions

Use a script to give temporary permissions:

-- Server-side
ExecuteCommand(string.format('add_principal identifier.steam:%s group.temp_admin', hex))

-- Remove after X time
SetTimeout(3600000, function() -- 1 hour
    ExecuteCommand(string.format('remove_principal identifier.steam:%s group.temp_admin', hex))
end)

Conditional Permissions

In your scripts, check multiple conditions:

if IsPlayerAceAllowed(source, 'police.menu') and 
   GetPlayerRoutingBucket(source) == 0 and
   IsPlayerOnDuty(source) then
    -- Open police menu
end

Wildcard

Use .* to give access to all sub-permissions:

# All police commands
add_ace group.police command.police.* allow

# Equivalent to:
# command.police.arrest
# command.police.handcuff
# command.police.fine
# etc.

Complete Configuration Example

Here's a complete ACE configuration example for a roleplay server:

####################################
# COMPLETE ACE CONFIGURATION
####################################

# ===== GLOBAL PERMISSIONS =====
# Block everything by default
add_ace builtin.everyone command.restart deny
add_ace builtin.everyone command.stop deny
add_ace builtin.everyone command.exec deny

# ===== SUPERADMIN =====
add_ace group.god command allow
add_ace group.god txadmin allow
add_principal identifier.steam:110000xxxxxx group.god

# ===== ADMIN =====
add_ace group.admin group.moderator allow
add_ace group.admin command.restart allow
add_ace group.admin command.setjob allow
add_ace group.admin command.givemoney allow
add_ace group.admin command.giveitem allow
add_ace group.admin command.car allow
add_principal identifier.steam:110000yyyyyy group.admin

# ===== MODERATOR =====
add_ace group.moderator group.support allow
add_ace group.moderator command.kick allow
add_ace group.moderator command.ban allow
add_ace group.moderator command.warn allow
add_principal identifier.discord:123456789 group.moderator

# ===== SUPPORT =====
add_ace group.support command.tp allow
add_ace group.support command.revive allow
add_ace group.support command.announce allow
add_principal identifier.steam:110000zzzzzz group.support

# ===== POLICE =====
add_ace group.police police.menu allow
add_ace group.police police.handcuff allow
add_ace group.police police.drag allow

# ===== EMS =====
add_ace group.ems ems.menu allow
add_ace group.ems command.revive allow
add_ace group.ems command.heal allow

# ===== VIP =====
add_ace group.vip vip.priority allow
add_ace group.vip vip.customskin allow

Conclusion

FiveM's ACE system is powerful and flexible. By following this guide, you can create a secure and hierarchical permissions structure for your server.

Key points to remember:

• Use groups rather than individual permissions
• Apply the principle of least privilege
• Use Steam ID as primary identifier
• Always test after modifications
• Document your permissions

For more information, consult the official FiveM documentation on ACE.